The report
The saved chat history looked repetitive: 4,972 user turns, each reading “hello.” But the requests carried a changing overrideConfig payload that could replace JavaScript executed by a Flowise workflow without changing the workflow stored on disk. Era Security documented the activity in seven instrumented Flowise 1.8.2 honeypots and published its investigation on November 3.
An API request carried the real instructions
The relevant path was Flowise's prediction API, where the overrideConfig mechanism allowed execution-time configuration to override a JavaScript function node. The message visible in the conversation record was not the actual executable payload. A review of chat text or saved workflow definitions alone could therefore miss the operational input. Era traced rapid requests separated by roughly 3.5 seconds and reconstructed stages of host reconnaissance, metadata and credential discovery, container checks, and attempted persistence. Era's investigation.
The underlying Flowise advisory predates the observed activity. Its affected-version boundary is earlier than 2.1.4; the documented Greeter honeypots used 1.8.2. The 2026 report is about activity observed against controlled decoy systems using an older execution feature, not a newly introduced zero-day. The exploit route did not require an LLM to interpret a prompt instruction. The HTTP runtime applied the injected configuration directly.
What the logs show and do not show
Era reports probing for sensitive files and cloud metadata, as well as attempts to establish persistence; the documented persistence attempts did not succeed in its controlled environment. Its wider internet measurements identify exposed Flowise instances and some candidates appearing vulnerable, but a fingerprint is not proof that any given live host was compromised. Nor does the Chinese-language tooling establish an actor's nationality or prove that an AI model independently planned the attack.
For defenders, the useful record is the effective per-request configuration and the resulting subprocess/network behavior, not only the agent's visible dialog or its saved chatflow. A request-time field can be executable authority. A workflow that is benign when inspected may behave differently when it is invoked with untrusted overrides. The Case reconstruction separates that runtime path from the researchers' observations.